16-bitowy podsystem ms-dos ntvdm cpu

**Posty:** 26 · przez **dryn3k** 14 Kwi 2010, 23:19

witam,
jak w temacie pojawia się taki komunikat podczas uruchomienia kompa, komp w ogóle nie odpowiada po załadowaniu windowsa wisi, pojawiać się to zaczęło po włożeniu prawdopodobnie zainfekowanego pena, wszelkie próby podmiany autoexeca, commanda, configa (z folderu repair jak i z cd windowsa) nie dają żadnych efektów, proszę o pomoc niżej logi z otl, posiadam win xp, dodam, że w trybie awaryjnym w system32 cały czas brakuje tych plików wyżej wymienionych

OTL

Kod: Zaznacz wszystko: OTL logfile created on: 2010-04-14 23:06:11 - Run 1 OTL by OldTimer - Version 3.2.1.1 Folder = C:\Documents and Settings\Administrator\Pulpit Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 767,00 Mb Total Physical Memory | 634,00 Mb Available Physical Memory | 83,00% Memory free 1,00 Gb Paging File | 1,00 Gb Available in Paging File | 96,00% Paging File free Paging file location(s): C:\pagefile.sys 672 1344 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 30,00 Gb Total Space | 4,33 Gb Free Space | 14,45% Space Free | Partition Type: NTFS Drive D: | 70,00 Gb Total Space | 2,87 Gb Free Space | 4,11% Space Free | Partition Type: NTFS Drive E: | 39,82 Gb Total Space | 3,05 Gb Free Space | 7,65% Space Free | Partition Type: NTFS F: Drive not present or media not loaded Drive G: | 269,40 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive H: | 593,36 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive I: | 178,12 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive J: | 9,23 Gb Total Space | 0,64 Gb Free Space | 6,97% Space Free | Partition Type: NTFS Drive K: | 3,80 Gb Total Space | 3,80 Gb Free Space | 99,91% Space Free | Partition Type: FAT32 Computer Name: KERMIT-025D00D6 Current User Name: Administrator Logged in as Administrator. Current Boot Mode: SafeMode Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010-04-14 22:57:48 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Pulpit\OTL.exe PRC - [2007-06-13 15:12:07 | 001,034,752 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010-04-14 22:57:48 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Pulpit\OTL.exe MOD - [2006-08-25 09:51:14 | 001,054,208 | R--- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2009-04-09 16:29:20 | 000,020,680 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe -- (EhttpSrv) SRV - [2009-04-09 16:19:08 | 000,731,840 | ---- | M] (ESET) [Auto | Stopped] -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe -- (ekrn) SRV - [2009-01-22 03:26:10 | 000,077,944 | ---- | M] (Autodesk) [On_Demand | Stopped] -- C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe -- (Autodesk Licensing Service) SRV - [2006-11-02 15:24:32 | 000,184,320 | ---- | M] (VoyagerSoft, LLC) [Auto | Stopped] -- C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe -- (ScReadSpool) SRV - [2005-07-27 12:53:00 | 000,536,576 | ---- | M] () [Auto | Stopped] -- C:\Program Files\MATLAB71\webserver\bin\win32\matlabserver.exe -- (matlabserver) SRV - [2004-08-13 20:05:56 | 002,532,576 | ---- | M] (Sygate Technologies, Inc.) [Auto | Stopped] -- C:\Program Files\Sygate\SPF\Smc.exe -- (SmcService) SRV - [2001-11-29 01:50:00 | 001,769,472 | ---- | M] (Borland Software Corporation) [On_Demand | Stopped] -- C:\Program Files\Borland\InterBase\bin\ibserver.exe -- (InterBaseServer) SRV - [2001-11-29 01:50:00 | 000,032,768 | ---- | M] (Borland Software Corporation) [Auto | Stopped] -- C:\Program Files\Borland\InterBase\bin\ibguard.exe -- (InterBaseGuardian) SRV - [1997-04-09 22:04:50 | 000,050,176 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\System32\CrypServ.exe -- (Crypkey License) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2010-04-14 23:04:02 | 000,075,264 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\hqbeghicslhznpx.sys -- (febnbvkfrkekrp) DRV - [2010-04-14 23:02:34 | 000,075,264 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\qjhpaedom.sys -- (lxqxolwosvu) DRV - [2010-04-14 21:48:46 | 000,075,264 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Documents and Settings\Kermit\Ustawienia lokalne\Temp\emynnvdrovk.sys -- (njxgbxogatdhv) DRV - [2009-04-09 16:21:12 | 000,055,768 | ---- | M] (ESET) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\epfwtdi.sys -- (epfwtdi) DRV - [2009-04-09 16:21:10 | 000,033,096 | ---- | M] (ESET) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\epfwndis.sys -- (Epfwndis) DRV - [2009-04-09 16:21:06 | 000,133,000 | ---- | M] (ESET) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\epfw.sys -- (epfw) DRV - [2009-04-09 16:18:02 | 000,107,256 | ---- | M] (ESET) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\ehdrv.sys -- (ehdrv) DRV - [2009-04-09 16:10:30 | 000,113,960 | ---- | M] (ESET) [File_System | Auto | Stopped] -- C:\WINDOWS\system32\drivers\eamon.sys -- (eamon) DRV - [2009-03-27 02:16:28 | 000,012,672 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\cpuz132_x32.sys -- (cpuz132) DRV - [2008-01-16 21:14:07 | 000,020,520 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ggsemc.sys -- (ggsemc) DRV - [2008-01-16 21:14:07 | 000,013,352 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ggflt.sys -- (ggflt) DRV - [2007-12-05 02:41:00 | 007,435,392 | ---- | M] (NVIDIA Corporation) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2007-04-23 16:54:50 | 000,100,488 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s115mgmt.sys -- (s115mgmt) Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM) DRV - [2007-04-23 16:54:50 | 000,098,568 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s115obex.sys -- (s115obex) DRV - [2007-04-23 16:54:48 | 000,108,680 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s115mdm.sys -- (s115mdm) DRV - [2007-04-23 16:54:48 | 000,015,112 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s115mdfl.sys -- (s115mdfl) DRV - [2007-04-23 16:54:46 | 000,083,208 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s115bus.sys -- (s115bus) Sony Ericsson Device 115 driver (WDM) DRV - [2007-04-03 14:57:42 | 000,083,336 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s116bus.sys -- (s116bus) Sony Ericsson Device 116 driver (WDM) DRV - [2006-09-13 20:19:02 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum) DRV - [2006-07-11 15:38:30 | 000,020,480 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus) DRV - [2006-07-11 15:38:28 | 000,057,856 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD) DRV - [2006-06-28 11:38:56 | 000,105,088 | R--- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\nvata.sys -- (nvata) DRV - [2006-06-19 00:51:32 | 000,043,520 | ---- | M] (Advanced Micro Devices) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8) DRV - [2006-06-06 06:09:26 | 004,284,928 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2005-02-11 10:24:24 | 000,079,488 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750obex.sys -- (k750obex) DRV - [2005-02-11 10:22:48 | 000,081,728 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750mgmt.sys -- (k750mgmt) DRV - [2005-02-11 10:21:10 | 000,089,872 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750mdm.sys -- (k750mdm) DRV - [2005-02-11 10:21:02 | 000,006,576 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750mdfl.sys -- (k750mdfl) DRV - [2005-02-11 10:19:20 | 000,055,216 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750bus.sys -- (k750bus) Sony Ericsson 750 driver (WDM) DRV - [2005-01-07 18:07:18 | 000,138,752 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Hdaudbus.sys -- (HDAudBus) DRV - [2004-08-10 18:05:44 | 000,014,240 | ---- | M] (Sygate Technologies, Inc.) [Kernel | Auto | Stopped] -- C:\WINDOWS\SYSTEM32\Drivers\wg6n.sys -- (wg6n) DRV - [2004-08-10 18:05:42 | 000,014,240 | ---- | M] (Sygate Technologies, Inc.) [Kernel | Auto | Stopped] -- C:\WINDOWS\SYSTEM32\Drivers\wg5n.sys -- (wg5n) DRV - [2004-08-10 18:05:42 | 000,014,240 | ---- | M] (Sygate Technologies, Inc.) [Kernel | Auto | Stopped] -- C:\WINDOWS\SYSTEM32\Drivers\wg4n.sys -- (wg4n) DRV - [2004-08-10 18:05:42 | 000,014,240 | ---- | M] (Sygate Technologies, Inc.) [Kernel | Auto | Stopped] -- C:\WINDOWS\SYSTEM32\Drivers\wg3n.sys -- (wg3n) DRV - [2004-08-10 17:53:14 | 000,021,075 | ---- | M] (Sygate Technologies, Inc.) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\wpsdrvnt.sys -- (wpsdrvnt) DRV - [2004-08-10 17:51:30 | 000,059,984 | ---- | M] (Sygate Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\SYSTEM32\Drivers\Teefer.sys -- (Teefer) DRV - [2004-08-03 23:59:44 | 000,095,360 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\atapi.sys -- (atapi) DRV - [2004-04-30 10:37:02 | 000,160,640 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\a347bus.sys -- (a347bus) DRV - [2004-04-30 10:33:00 | 000,005,248 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\a347scsi.sys -- (a347scsi) DRV - [2001-09-05 08:55:36 | 000,014,940 | R--- | M] (Ericsson Mobile Communications AB) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Epiusb.sys -- (Epiusb) DRV - [1997-04-09 21:31:22 | 000,020,768 | ---- | M] () [Kernel | System | Stopped] -- C:\WINDOWS\system32\ckldrv.sys -- (NetworkX) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010-04-07 20:48:47 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010-04-07 20:48:47 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2009-11-16 22:04:13 | 000,000,000 | ---D | M] [2010-04-13 10:11:51 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2007-12-11 10:07:00 | 000,307,200 | ---- | M] (ESKA) -- C:\Program Files\Mozilla Firefox\plugins\npOggX.dll [2010-03-21 23:11:05 | 000,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2010-03-21 23:11:05 | 000,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2010-03-21 23:11:05 | 000,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2010-03-21 23:11:05 | 000,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2010-03-21 23:11:05 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2010-03-21 23:11:05 | 000,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: ([2001-10-26 18:45:16 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (no name) - {00A6FAF1-072E-44cf-8957-5838F569A31D} - No CLSID value found. O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (no name) - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - No CLSID value found. O2 - BHO: (Solid Converter PDF) - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll (VoyagerSoft, LLC) O3 - HKLM\..\Toolbar: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - No CLSID value found. O3 - HKLM\..\Toolbar: (Solid Converter PDF) - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll (VoyagerSoft, LLC) O4 - HKLM..\Run: [Alcmtr] c:\windows\Alcmtr.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET Smart Security\egui.exe (ESET) O4 - HKLM..\Run: [Hijack This] C:\Documents and Settings\Kermit\Pulpit\klucze.nod.eset.22.02.10.exe File not found O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe () O4 - HKLM..\Run: [SkyTel] c:\windows\SkyTel.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SmcService] C:\Program Files\Sygate\SPF\Smc.exe (Sygate Technologies, Inc.) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Przyspieszenie uruchomienia programu AutoCAD.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe (Autodesk, Inc) O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.) O16 - DPF: {41564D57-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 62.21.99.95 O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Program Files\Orcad\Capture\itss.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Program Files\Orcad\Capture\itss.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (Explorer.exe) - c:\windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: TaskMan - (C:\Documents and Settings\Administrator\Dane aplikacji\jlwcbb.exe) - C:\Documents and Settings\Administrator\Dane aplikacji\jlwcbb.exe (bpbekvmm) O20 - HKCU Winlogon: Shell - (explorer.exe) - c:\windows\explorer.exe (Microsoft Corporation) O20 - HKCU Winlogon: Shell - (C:\Documents and Settings\Administrator\Dane aplikacji\jlwcbb.exe) - C:\Documents and Settings\Administrator\Dane aplikacji\jlwcbb.exe (bpbekvmm) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008-01-08 00:46:18 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2003-09-22 07:56:14 | 000,000,027 | R--- | M] () - G:\autorun.inf -- [ CDFS ] O32 - AutoRun File - [2004-08-18 20:41:17 | 000,000,145 | R--- | M] () - H:\autorun.inf -- [ CDFS ] O32 - AutoRun File - [2010-04-14 23:02:06 | 000,000,225 | ---- | M] () - K:\autorun.inf -- [ FAT32 ] O33 - MountPoints2\G\Shell - "" = AutoRun O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\start.exe -- [2003-10-23 00:40:12 | 006,245,944 | R--- | M] (Macromedia, Inc.) O33 - MountPoints2\H\Shell - "" = AutoRun O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\Setup\rsrc\AUTORUN.EXE -- [2004-08-03 22:29:57 | 000,057,344 | R--- | M] () O33 - MountPoints2\H\Shell\dinstall\command - "" = H:\DirectX\dxsetup.exe -- [2004-07-09 13:08:36 | 000,472,576 | R--- | M] (Microsoft Corporation) O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010-04-14 23:06:04 | 000,561,664 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Pulpit\OTL.exe [2010-04-14 23:02:04 | 000,000,000 | -HSD | C] -- C:\WINDOWS\CSC [2010-04-14 22:07:33 | 000,118,784 | RHS- | C] (bpbekvmm) -- C:\Documents and Settings\Administrator\Dane aplikacji\jlwcbb.exe [2010-04-14 22:07:29 | 000,000,000 | --SD | C] -- C:\Documents and Settings\Administrator\Dane aplikacji\Microsoft [2010-04-14 22:07:29 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator\SendTo [2010-04-14 22:07:29 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator\Dane aplikacji [2010-04-14 22:07:29 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Menu Start [2010-04-14 22:07:29 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Administrator\Cookies [2010-04-14 22:07:29 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne [2010-04-14 22:07:29 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\Szablony [2010-04-14 22:07:29 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\Recent [2010-04-14 22:07:29 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\PrintHood [2010-04-14 22:07:29 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\NetHood [2010-04-14 22:07:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ulubione [2010-04-14 22:07:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Pulpit [2010-04-14 22:07:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Moje dokumenty [2010-04-14 22:07:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft [2010-03-22 11:32:42 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight [2009-11-16 22:04:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\ESET [2009-03-23 16:51:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Google [2008-11-05 21:51:48 | 000,018,944 | ---- | C] ( ) -- C:\WINDOWS\System32\implode.dll [2008-04-29 15:25:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Apple [2008-01-30 18:27:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Adobe [2008-01-30 02:58:00 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji\Microsoft [2008-01-16 14:50:04 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Microsoft [2008-01-08 19:36:34 | 000,160,640 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\a347bus.sys [2008-01-08 19:36:34 | 000,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\a347scsi.sys [2008-01-08 00:56:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft [2008-01-08 00:54:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010-04-14 23:05:01 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010-04-14 23:04:05 | 000,786,432 | -H-- | M] () -- C:\Documents and Settings\Administrator\NTUSER.DAT [2010-04-14 22:59:22 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010-04-14 22:57:48 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Pulpit\OTL.exe [2010-04-14 22:29:31 | 000,000,188 | -HS- | M] () -- C:\Documents and Settings\Administrator\ntuser.ini [2010-04-14 21:50:30 | 000,147,488 | ---- | M] () -- C:\WINDOWS\System32\drivers\str.sys [2010-04-14 21:48:39 | 000,118,784 | RHS- | M] (bpbekvmm) -- C:\Documents and Settings\Administrator\Dane aplikacji\jlwcbb.exe [2010-04-13 09:59:14 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010-04-13 01:23:48 | 000,008,766 | ---- | M] () -- C:\WINDOWS\hh.dat [2010-03-28 17:50:30 | 000,448,004 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat [2010-03-28 17:50:30 | 000,392,296 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010-03-28 17:50:30 | 000,074,230 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat [2010-03-28 17:50:30 | 000,058,596 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010-03-28 17:50:29 | 000,984,778 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010-03-20 13:02:52 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2010-03-19 22:58:04 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2010-03-16 14:32:27 | 000,000,167 | ---- | M] () -- C:\WINDOWS\ConverterCore.INI [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-04-14 22:29:08 | 000,051,823 | ---- | C] () -- C:\WINDOWS\System32\command.co [2010-04-14 22:27:48 | 000,002,596 | ---- | C] () -- C:\WINDOWS\config.nt_ [2010-04-14 22:07:30 | 000,000,188 | -HS- | C] () -- C:\Documents and Settings\Administrator\ntuser.ini [2010-04-14 22:07:29 | 000,786,432 | -H-- | C] () -- C:\Documents and Settings\Administrator\NTUSER.DAT [2010-04-14 22:07:29 | 000,180,224 | -H-- | C] () -- C:\Documents and Settings\Administrator\NTUSER.DAT.LOG [2010-04-14 21:50:13 | 000,147,488 | ---- | C] () -- C:\WINDOWS\System32\drivers\str.sys [2009-06-16 14:02:50 | 000,000,167 | ---- | C] () -- C:\WINDOWS\ConverterCore.INI [2009-06-16 13:09:48 | 000,000,158 | ---- | C] () -- C:\WINDOWS\matlab.ini [2009-06-15 23:22:01 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\FTCJTAG.dll [2009-06-15 23:22:01 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\drivers\FTCJTAG.dll [2009-01-29 00:37:30 | 000,036,352 | ---- | C] () -- C:\WINDOWS\System32\SX32W.DLL [2009-01-29 00:37:30 | 000,005,881 | ---- | C] () -- C:\WINDOWS\RIDE.ini [2008-11-21 01:58:19 | 000,000,799 | ---- | C] () -- C:\WINDOWS\CoDUO.INI [2008-11-06 00:37:29 | 000,000,725 | ---- | C] () -- C:\WINDOWS\CoD.INI [2008-11-05 21:51:49 | 000,251,904 | ---- | C] () -- C:\WINDOWS\System32\orant71.dll [2008-11-05 21:51:48 | 000,903,168 | ---- | C] () -- C:\WINDOWS\System32\mitmdl30.dll [2008-11-05 21:51:48 | 000,176,128 | ---- | C] () -- C:\WINDOWS\System32\lffax60n.dll [2008-11-05 21:51:48 | 000,141,824 | ---- | C] () -- C:\WINDOWS\System32\lfcmp60n.dll [2008-11-05 21:51:48 | 000,110,080 | ---- | C] () -- C:\WINDOWS\System32\lfpng60n.dll [2008-11-05 21:51:48 | 000,046,080 | ---- | C] () -- C:\WINDOWS\System32\lftif60n.dll [2008-11-05 21:51:48 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\lfpcx60n.dll [2008-11-05 21:51:48 | 000,022,528 | ---- | C] () -- C:\WINDOWS\System32\lfpct60n.dll [2008-11-05 21:51:48 | 000,022,528 | ---- | C] () -- C:\WINDOWS\System32\lfeps60n.dll [2008-11-05 21:51:48 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\lfbmp60n.dll [2008-11-05 21:51:48 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\lfpsd60n.dll [2008-11-05 21:51:48 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\lftga60n.dll [2008-11-05 21:51:48 | 000,019,456 | ---- | C] () -- C:\WINDOWS\System32\lfwpg60n.dll [2008-11-05 21:51:48 | 000,019,456 | ---- | C] () -- C:\WINDOWS\System32\lfwmf60n.dll [2008-11-05 21:51:48 | 000,018,432 | ---- | C] () -- C:\WINDOWS\System32\lfmsp60n.dll [2008-11-05 21:51:48 | 000,017,920 | ---- | C] () -- C:\WINDOWS\System32\lfmac60n.dll [2008-06-20 21:38:31 | 000,001,632 | ---- | C] () -- C:\WINDOWS\TextEdit99SE.INI [2008-06-10 01:28:14 | 000,000,297 | ---- | C] () -- C:\WINDOWS\SchDwgUtility99SE.ini [2008-06-10 01:11:41 | 000,001,550 | ---- | C] () -- C:\WINDOWS\Netlist99SE.INI [2008-06-09 20:48:08 | 000,000,758 | ---- | C] () -- C:\WINDOWS\ProHelp99SE.INI [2008-06-09 20:44:59 | 000,083,683 | R--- | C] () -- C:\WINDOWS\CRP9516A.DLL [2008-06-09 20:44:59 | 000,023,552 | R--- | C] () -- C:\WINDOWS\CRYP95A.DLL [2008-06-09 20:43:50 | 000,020,768 | ---- | C] () -- C:\WINDOWS\System32\CKLDRV.sys [2008-06-09 20:43:43 | 000,006,815 | ---- | C] () -- C:\WINDOWS\Client99SE.INI [2008-06-09 20:43:43 | 000,003,935 | ---- | C] () -- C:\WINDOWS\AdvSch99SE.ini [2008-06-09 20:43:43 | 000,000,369 | ---- | C] () -- C:\WINDOWS\HelpAdvisor99SE.ini [2008-06-09 20:43:43 | 000,000,332 | ---- | C] () -- C:\WINDOWS\CRYPKEY.INI [2008-06-09 20:43:43 | 000,000,073 | ---- | C] () -- C:\WINDOWS\AdvSIM99SE.INI [2008-06-09 20:11:01 | 000,002,581 | ---- | C] () -- C:\WINDOWS\SE.INI [2008-04-08 13:45:50 | 000,000,000 | ---- | C] () -- C:\WINDOWS\FILTER.INI [2008-01-15 15:05:36 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.INI [2008-01-14 14:40:24 | 000,164,352 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2008-01-14 14:40:23 | 001,559,040 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2008-01-14 14:40:23 | 000,282,624 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2008-01-14 14:40:22 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2008-01-14 14:40:22 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2008-01-14 14:40:22 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2008-01-14 13:20:29 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2008-01-08 17:31:33 | 000,000,672 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2008-01-08 01:55:24 | 000,000,132 | ---- | C] () -- C:\WINDOWS\winamp.ini [2008-01-08 01:17:31 | 000,135,168 | R--- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll [2008-01-08 01:05:03 | 000,004,253 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2008-01-08 01:04:59 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2007-12-05 02:41:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2007-12-05 02:41:00 | 001,474,560 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2007-12-05 02:41:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2007-12-05 02:41:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2007-12-05 02:41:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2004-08-10 21:39:04 | 000,218,264 | ---- | C] () -- C:\WINDOWS\System32\SetAid.dll [2004-08-03 23:59:44 | 000,095,360 | ---- | C] () -- C:\WINDOWS\System32\drivers\atapi.sys [2001-10-28 18:42:30 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll < End of report >

Extras

Kod: Zaznacz wszystko: OTL Extras logfile created on: 2010-04-14 23:06:11 - Run 1 OTL by OldTimer - Version 3.2.1.1 Folder = C:\Documents and Settings\Administrator\Pulpit Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 767,00 Mb Total Physical Memory | 634,00 Mb Available Physical Memory | 83,00% Memory free 1,00 Gb Paging File | 1,00 Gb Available in Paging File | 96,00% Paging File free Paging file location(s): C:\pagefile.sys 672 1344 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 30,00 Gb Total Space | 4,33 Gb Free Space | 14,45% Space Free | Partition Type: NTFS Drive D: | 70,00 Gb Total Space | 2,87 Gb Free Space | 4,11% Space Free | Partition Type: NTFS Drive E: | 39,82 Gb Total Space | 3,05 Gb Free Space | 7,65% Space Free | Partition Type: NTFS F: Drive not present or media not loaded Drive G: | 269,40 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive H: | 593,36 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive I: | 178,12 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive J: | 9,23 Gb Total Space | 0,64 Gb Free Space | 6,97% Space Free | Partition Type: NTFS Drive K: | 3,80 Gb Total Space | 3,80 Gb Free Space | 99,91% Space Free | Partition Type: FAT32 Computer Name: KERMIT-025D00D6 Current User Name: Administrator Logged in as Administrator. Current Boot Mode: SafeMode Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html [@ = Reg Error: Value error.] -- Reg Error: Key error. File not found [color=#E56717]========== Shell Spawning ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* htmlfile [edit] -- Reg Error: Key error. http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation) https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\Winamp.exe" /BOOKMARK "%1" (Nullsoft) Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\Winamp.exe" /ADD "%1" (Nullsoft) Directory [Winamp.Play] -- "C:\Program Files\Winamp\Winamp.exe" "%1" (Nullsoft) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List] "139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002 "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008 "139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002 "2486:TCP" = 2486:TCP:*:Enabled:adtua [color=#E56717]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\Gadu-Gadu\gg.exe" = C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program glowny -- (Gadu-Gadu Sp. z oo) "C:\Program Files\eMule\emule.exe" = C:\Program Files\eMule\emule.exe:*:Enabled:eMule -- (http://www.emule-project.net) "C:\Program Files\DNA\btdna.exe" = C:\Program Files\DNA\btdna.exe:*:Enabled:DNA -- File not found "C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent -- File not found "C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.) "C:\Program Files\Java\jre1.6.0_03\launch4j-tmp\JDownloader.exe" = C:\Program Files\Java\jre1.6.0_03\launch4j-tmp\JDownloader.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.) "C:\WINDOWS\system32\java.exe" = C:\WINDOWS\system32\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.) "D:\gry\quake3\quake3.exe" = D:\gry\quake3\quake3.exe:*:Enabled:quake3 -- () [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime "{1E14CAA4-A544-11D6-80A8-006097DB005E}" = Maxwell SV Version 9.0 "{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 17 "{2750B389-A2D2-4953-99CA-27C1F2A8E6FD}" = Microsoft SQL Server 2005 Tools Express Edition "{2864C41B-EF2D-4640-95A2-526276524519}" = Borland C++Builder 6 "{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3 "{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support "{5783F2D7-5001-0415-0002-0060B0CE6BBA}" = AutoCAD 2007 - Polski "{5AF71003-1797-4D93-9F37-4F2125CBF539}" = Microsoft .NET Framework 2.0 Language Pack - PLK "{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.2 "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update "{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin "{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0 "{72263053-50D1-4598-9502-51ED64E54C51}" = Borland Delphi 7 "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{90110415-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003 "{90120000-0020-0415-0000-0000000FF1CE}" = Pakiet zgodności dla systemu Office 2007 "{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}" = Google Earth "{9BC76CCE-A9EC-4A3A-9B51-D823805E1D1F}" = SolidConverterPDF "{9E35B051-C7EE-47CB-BA43-9A7FFD4E61DE}" = OpenOffice.org 3.1 "{A662E280-64A8-4CF5-8407-13D0808602B3}" = Call of Duty - United Offensive "{AC76BA86-7AD7-1033-7B44-A70900000002}" = Adobe Reader 7.0.9 "{BF448A52-C83E-455D-B5D3-FD9E964C9419}" = Sygate Personal Firewall Pro "{E1180142-3B31-4DCC-9D27-7AC2D37662BF}" = LightScribe 1.4.124.1 "{E9F81423-211E-46B6-9AE0-38568BC5CF6F}" = "{EB490160-A606-11D3-9B22-00A0C971727F}" = Protel 99 SE Trial Version "{EFB21DE7-8C19-4A88-BB28-A766E16493BC}" = Adobe Photoshop CS "{F0530C58-5AAC-4842-8862-FA7FA2AE7FF7}" = ESET Smart Security "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "6A1545AE87FC8D98ACA7539CE7AA69DF2A5C7E1C" = Pakiet sterowników systemu Windows - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0) "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "ALLPlayer V3.1_is1" = ALLPlayer V3.X "Atomic Clock Sync" = Atomic Clock Sync "Autodesk DWF Viewer" = Autodesk DWF Viewer "BeInspired! Gramatyka 1 & 21.0" = BeInspired! Gramatyka 1 & 2 "Call of Duty" = Call of Duty "CPUID HWMonitor_is1" = CPUID HWMonitor 1.15 "EAGLE 4.15" = EAGLE 4.15 "EAX Unified" = EAX Unified "EDU CD. Vademecum języka angielskiego_is1" = EDU CD. Vademecum języka angielskiego "Electronics_Workbench_V5" = Electronics Workbench V5.12 "eMule" = eMule "ET3" = English Translator 3 "Far Cry" = Far Cry "Gadu-Gadu" = Gadu-Gadu 7.0 "GoldWave v5.08" = GoldWave v5.08 "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs "ie7" = Windows Internet Explorer 7 "Img2CAD_is1" = Img2CAD 7.0 "InstallShield_{A662E280-64A8-4CF5-8407-13D0808602B3}" = Call of Duty - United Offensive "InterBase" = InterBase 6.5 "ipla" = ipla 2.0.3 "IrfanView" = IrfanView (remove only) "Keil µVision3" = Keil µVision3 "KLiteCodecPack_is1" = K-Lite Codec Pack 3.6.5 Full "MatlabR14SP3" = MATLAB 7.1 "Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0 "Microsoft .NET Framework 2.0 Language Pack - PLK" = Microsoft .NET Framework 2.0 — pakiet języka polskiego "Monkey's Audio_is1" = Monkey's Audio "Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3) "MPE" = MyPhoneExplorer "MyWebSearch bar Uninstall" = My Web Search (Popular Screensavers) "NAPIPROJEKT_is1" = NAPIPROJEKT 1.0.6.2 "Neat Image_is1" = Neat Image v5.2 Pro+ "Nero - Burning Rom!UninstallKey" = Nero OEM "Niezbędnik CD_is1" = Niezbędnik CD "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs "NVIDIA Drivers" = NVIDIA Drivers "Orcad Family Release 9.2 Standalone" = Orcad Family Release 9.2 Standalone "Picasa 3" = Picasa 3 "RealAlt_is1" = Real Alternative 1.44 "ShiftN_is1" = ShiftN 3.3 "Słownik angielsko-polski_is1" = Słownik angielsko-polski wersja 2.24 "Spolszczenie Call of Duty v1.0.9 *" = Spolszczenie Call of Duty v1.0.9 * "SystemRequirementsLab" = System Requirements Lab "VLC media player" = VLC media player 1.0.2 "Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 "Winamp" = Winamp "Windows Media Format Runtime" = Windows Media Format 11 runtime "Windows Media Player" = Windows Media Player 11 "WinRAR archiver" = Archiwizator WinRAR "WMFDist11" = Windows Media Format 11 runtime "wmp11" = Windows Media Player 11 "Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0 "WWW File Share Pro_is1" = WWW File Share Pro 5.0 [color=#E56717]========== Last 10 Event Log Errors ==========[/color] [ Application Events ] Error - 2009-02-27 15:54:43 | Computer Name = KERMIT-025D00D6 | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca AcroRd32.exe, wersja 7.0.8.218, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-03-02 15:34:43 | Computer Name = KERMIT-025D00D6 | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca explorer.exe, wersja 6.0.2900.3156, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-03-09 18:52:26 | Computer Name = KERMIT-025D00D6 | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd svchost.exe, wersja 5.1.2600.2180, moduł powodujący błąd AcGenral.dll, wersja 5.1.2600.2558, adres błędu 0x000116e2. Error - 2009-03-13 04:14:54 | Computer Name = KERMIT-025D00D6 | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca firefox.exe, wersja 1.9.0.3334, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-04-06 08:56:24 | Computer Name = KERMIT-025D00D6 | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd explorer.exe, wersja 6.0.2900.3156, moduł powodujący błąd , wersja 0.0.0.0, adres błędu 0x00000000. Error - 2009-04-16 05:56:32 | Computer Name = KERMIT-025D00D6 | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca ST6UNST.EXE, wersja 6.0.84.50, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-04-16 05:56:34 | Computer Name = KERMIT-025D00D6 | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca ST6UNST.EXE, wersja 6.0.84.50, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-04-24 14:58:53 | Computer Name = KERMIT-025D00D6 | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca ALLPlayer.exe, wersja 3.1.0.0, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-04-25 07:20:32 | Computer Name = KERMIT-025D00D6 | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca ALLPlayer.exe, wersja 3.1.0.0, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-04-29 09:48:49 | Computer Name = KERMIT-025D00D6 | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca firefox.exe, wersja 1.9.0.3399, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. [ Application Events ] Error - 2009-02-27 15:54:43 | Computer Name = KERMIT-025D00D6 | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca AcroRd32.exe, wersja 7.0.8.218, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-03-02 15:34:43 | Computer Name = KERMIT-025D00D6 | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca explorer.exe, wersja 6.0.2900.3156, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-03-09 18:52:26 | Computer Name = KERMIT-025D00D6 | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd svchost.exe, wersja 5.1.2600.2180, moduł powodujący błąd AcGenral.dll, wersja 5.1.2600.2558, adres błędu 0x000116e2. Error - 2009-03-13 04:14:54 | Computer Name = KERMIT-025D00D6 | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca firefox.exe, wersja 1.9.0.3334, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-04-06 08:56:24 | Computer Name = KERMIT-025D00D6 | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd explorer.exe, wersja 6.0.2900.3156, moduł powodujący błąd , wersja 0.0.0.0, adres błędu 0x00000000. Error - 2009-04-16 05:56:32 | Computer Name = KERMIT-025D00D6 | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca ST6UNST.EXE, wersja 6.0.84.50, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-04-16 05:56:34 | Computer Name = KERMIT-025D00D6 | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca ST6UNST.EXE, wersja 6.0.84.50, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-04-24 14:58:53 | Computer Name = KERMIT-025D00D6 | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca ALLPlayer.exe, wersja 3.1.0.0, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-04-25 07:20:32 | Computer Name = KERMIT-025D00D6 | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca ALLPlayer.exe, wersja 3.1.0.0, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-04-29 09:48:49 | Computer Name = KERMIT-025D00D6 | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca firefox.exe, wersja 1.9.0.3399, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. [ System Events ] Error - 2010-04-14 17:05:22 | Computer Name = KERMIT-025D00D6 | Source = DCOM | ID = 10005 Description = Model DCOM odebrał błąd „%1084” podczas próby uruchomienia usługi netman z argumentami „” w celu uruchomienia serwera: {BA126AE5-2166-11D1-B1D0-00805FC1270E} Error - 2010-04-14 17:05:31 | Computer Name = KERMIT-025D00D6 | Source = DCOM | ID = 10005 Description = Model DCOM odebrał błąd „%1084” podczas próby uruchomienia usługi EventSystem z argumentami „” w celu uruchomienia serwera: {1BE1F766-5536-11D1-B726-00C04FB926AF} Error - 2010-04-14 17:05:59 | Computer Name = KERMIT-025D00D6 | Source = DCOM | ID = 10005 Description = Model DCOM odebrał błąd „%1084” podczas próby uruchomienia usługi StiSvc z argumentami „” w celu uruchomienia serwera: {A1F4E726-8CF1-11D1-BF92-0060081ED811} Error - 2010-04-14 17:06:26 | Computer Name = KERMIT-025D00D6 | Source = DCOM | ID = 10005 Description = Model DCOM odebrał błąd „%1084” podczas próby uruchomienia usługi StiSvc z argumentami „” w celu uruchomienia serwera: {A1F4E726-8CF1-11D1-BF92-0060081ED811} Error - 2010-04-14 17:06:39 | Computer Name = KERMIT-025D00D6 | Source = Service Control Manager | ID = 7001 Description = Usługa Klient DHCP zależy od usługi NetBios przez TCP/IP, której nie można uruchomić z powodu następującego błędu: %%31 Error - 2010-04-14 17:06:39 | Computer Name = KERMIT-025D00D6 | Source = Service Control Manager | ID = 7001 Description = Usługa Klient DNS zależy od usługi Sterownik protokołu TCP/IP, której nie można uruchomić z powodu następującego błędu: %%31 Error - 2010-04-14 17:06:39 | Computer Name = KERMIT-025D00D6 | Source = Service Control Manager | ID = 7001 Description = Usługa Pomoc TCP/IP NetBIOS zależy od usługi AFD, której nie można uruchomić z powodu następującego błędu: %%31 Error - 2010-04-14 17:06:39 | Computer Name = KERMIT-025D00D6 | Source = Service Control Manager | ID = 7001 Description = Usługa Usługi IPSEC zależy od usługi Sterownik IPSEC, której nie można uruchomić z powodu następującego błędu: %%31 Error - 2010-04-14 17:06:39 | Computer Name = KERMIT-025D00D6 | Source = Service Control Manager | ID = 7023 Description = Usługa Pomoc i obsługa techniczna zakończyła działanie; wystąpił następujący błąd: %%126 Error - 2010-04-14 17:06:39 | Computer Name = KERMIT-025D00D6 | Source = Service Control Manager | ID = 7026 Description = Nie można załadować następujących sterowników startu rozruchowego lub systemowego: AFD AmdK8 ehdrv epfwtdi Fips IPSec MRxSmb NetBIOS NetBT NetworkX RasAcd Rdbss Tcpip wpsdrvnt < End of report >

**Posty:** 18165 · przez **wojtas** 14 Kwi 2010, 23:29

Proszę zastosować się do obowiązkowych zasad w dziale bezpieczeństwo . Wstaw log z Gmera tylko przed tworzeniem usuń programy emulujące + sptd.sys

programy-emulujace-napedy-wazne-vt117886.html

**Posty:** 26 · przez **dryn3k** 14 Kwi 2010, 23:37

no właśnie problem polega na tym że alcohol nie chce się usunąć z trybu awaryjnego, a po normalnym uruchomieniu kompa nie da się zupełnie nic zrobić ... i nie wiem czy mam robić log z gmera w tym wypadku i czy sptd odinstalować ...

**Posty:** 18165 · przez **wojtas** 14 Kwi 2010, 23:43

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
DRV - [2010-04-14 23:04:02 | 000,075,264 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\hqbeghicslhznpx.sys -- (febnbvkfrkekrp)
DRV - [2010-04-14 23:02:34 | 000,075,264 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\qjhpaedom.sys -- (lxqxolwosvu)
DRV - [2010-04-14 21:48:46 | 000,075,264 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Documents and Settings\Kermit\Ustawienia lokalne\Temp\emynnvdrovk.sys -- (njxgbxogatdhv)
O2 - BHO: (no name) - {00A6FAF1-072E-44cf-8957-5838F569A31D} - No CLSID value found.
O2 - BHO: (no name) - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - No CLSID value found.
O4 - HKLM..\Run: [Hijack This] C:\Documents and Settings\Kermit\Pulpit\klucze.nod.eset.22.02.10.exe File not found
O20 - HKLM Winlogon: TaskMan - (C:\Documents and Settings\Administrator\Dane aplikacji\jlwcbb.exe) - C:\Documents and Settings\Administrator\Dane aplikacji\jlwcbb.exe (bpbekvmm)
O20 - HKCU Winlogon: Shell - (C:\Documents and Settings\Administrator\Dane aplikacji\jlwcbb.exe) - C:\Documents and Settings\Administrator\Dane aplikacji\jlwcbb.exe (bpbekvmm)
O32 - AutoRun File - [2003-09-22 07:56:14 | 000,000,027 | R--- | M] () - G:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2004-08-18 20:41:17 | 000,000,145 | R--- | M] () - H:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2010-04-14 23:02:06 | 000,000,225 | ---- | M] () - K:\autorun.inf -- [ FAT32 ]
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\start.exe -- [2003-10-23 00:40:12 | 006,245,944 | R--- | M] (Macromedia, Inc.)
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\Setup\rsrc\AUTORUN.EXE -- [2004-08-03 22:29:57 | 000,057,344 | R--- | M] ()
O33 - MountPoints2\H\Shell\dinstall\command - "" = H:\DirectX\dxsetup.exe -- [2004-07-09 13:08:36 | 000,472,576 | R--- | M] (Microsoft Corporation)

:Files
C:\WINDOWS\System32\drivers\str.sys
C:\WINDOWS\System32\command.co
C:\WINDOWS\config.nt_
C:\Documents and Settings\Administrator\Dane aplikacji\jlwcbb.exe

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]

:Commands
[emptytemp]

Kliknij w Run Fix. I potwierdź reset kompa .

Następnie uruchamiasz OTL z opcją Run Scan. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia komputera + log z Gmera

**Posty:** 26 · przez **dryn3k** 15 Kwi 2010, 00:14

loga z gmera w końcu nie wiem czy mam robić, system dalej wisi, komunikat z tytułu posta się już nie pojawia

raport z czyszczenia

Kod: Zaznacz wszystko: All processes killed ========== OTL ========== Service febnbvkfrkekrp stopped successfully! Service\Driver key febnbvkfrkekrp not found. C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\hqbeghicslhznpx.sys moved successfully. Error: Unable to stop service lxqxolwosvu! Service lxqxolwosvu deleted successfully! C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\qjhpaedom.sys moved successfully. Error: Unable to stop service njxgbxogatdhv! Service njxgbxogatdhv deleted successfully! C:\Documents and Settings\Kermit\Ustawienia lokalne\Temp\emynnvdrovk.sys moved successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}\ not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{07B18EA9-A523-4961-B6BB-170DE4475CCA} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Hijack This not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\TaskMan:C:\Documents and Settings\Administrator\Dane aplikacji\jlwcbb.exe deleted successfully. C:\Documents and Settings\Administrator\Dane aplikacji\jlwcbb.exe moved successfully. Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Documents and Settings\Administrator\Dane aplikacji\jlwcbb.exe deleted successfully. File C:\Documents and Settings\Administrator\Dane aplikacji\jlwcbb.exe not found. File move failed. G:\autorun.inf scheduled to be moved on reboot. File move failed. H:\autorun.inf scheduled to be moved on reboot. File move failed. K:\autorun.inf scheduled to be moved on reboot. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ not found. File move failed. G:\start.exe scheduled to be moved on reboot. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H\ not found. File move failed. H:\Setup\rsrc\AUTORUN.EXE scheduled to be moved on reboot. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H\ not found. File move failed. H:\DirectX\dxsetup.exe scheduled to be moved on reboot. ========== FILES ========== File\Folder C:\WINDOWS\System32\drivers\str.sys not found. C:\WINDOWS\System32\COMMAND.CO moved successfully. C:\WINDOWS\config.nt_ moved successfully. File\Folder C:\Documents and Settings\Administrator\Dane aplikacji\jlwcbb.exe not found. ========== REGISTRY ========== Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\ deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 134099514 bytes ->Temporary Internet Files folder emptied: 282002 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Kermit ->Temp folder emptied: 69798289 bytes ->Temporary Internet Files folder emptied: 179395284 bytes ->Java cache emptied: 86284055 bytes ->FireFox cache emptied: 39440517 bytes ->Flash cache emptied: 95666 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32784000 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2225176 bytes %systemroot%\System32 .tmp files removed: 2596 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 223751076 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 733,00 mb OTL by OldTimer - Version 3.2.1.1 log created on 04142010_234606 Files\Folders moved on Reboot... File move failed. G:\autorun.inf scheduled to be moved on reboot. File move failed. H:\autorun.inf scheduled to be moved on reboot. File\Folder K:\autorun.inf not found! File move failed. G:\start.exe scheduled to be moved on reboot. File move failed. H:\Setup\rsrc\AUTORUN.EXE scheduled to be moved on reboot. File move failed. H:\DirectX\dxsetup.exe scheduled to be moved on reboot. Registry entries deleted on Reboot...

otl

Kod: Zaznacz wszystko: OTL logfile created on: 2010-04-15 00:08:05 - Run 2 OTL by OldTimer - Version 3.2.1.1 Folder = C:\Documents and Settings\Kermit\Pulpit Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 767,00 Mb Total Physical Memory | 601,00 Mb Available Physical Memory | 78,00% Memory free 1,00 Gb Paging File | 1,00 Gb Available in Paging File | 95,00% Paging File free Paging file location(s): C:\pagefile.sys 672 1344 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 30,00 Gb Total Space | 5,06 Gb Free Space | 16,88% Space Free | Partition Type: NTFS Drive D: | 70,00 Gb Total Space | 2,87 Gb Free Space | 4,11% Space Free | Partition Type: NTFS Drive E: | 39,82 Gb Total Space | 3,05 Gb Free Space | 7,65% Space Free | Partition Type: NTFS Drive F: | 597,40 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive G: | 269,40 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive H: | 593,36 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive I: | 178,12 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive J: | 9,23 Gb Total Space | 0,64 Gb Free Space | 6,97% Space Free | Partition Type: NTFS Drive K: | 3,80 Gb Total Space | 3,80 Gb Free Space | 99,88% Space Free | Partition Type: FAT32 Computer Name: KERMIT-025D00D6 Current User Name: Kermit Logged in as Administrator. Current Boot Mode: SafeMode Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010-04-14 22:57:48 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kermit\Pulpit\OTL.exe PRC - [2007-06-13 15:12:07 | 001,034,752 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010-04-14 22:57:48 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kermit\Pulpit\OTL.exe MOD - [2006-08-25 09:51:14 | 001,054,208 | R--- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2009-04-09 16:29:20 | 000,020,680 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe -- (EhttpSrv) SRV - [2009-04-09 16:19:08 | 000,731,840 | ---- | M] (ESET) [Auto | Stopped] -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe -- (ekrn) SRV - [2009-01-22 03:26:10 | 000,077,944 | ---- | M] (Autodesk) [On_Demand | Stopped] -- C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe -- (Autodesk Licensing Service) SRV - [2006-11-02 15:24:32 | 000,184,320 | ---- | M] (VoyagerSoft, LLC) [Auto | Stopped] -- C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe -- (ScReadSpool) SRV - [2005-07-27 12:53:00 | 000,536,576 | ---- | M] () [Auto | Stopped] -- C:\Program Files\MATLAB71\webserver\bin\win32\matlabserver.exe -- (matlabserver) SRV - [2004-08-13 20:05:56 | 002,532,576 | ---- | M] (Sygate Technologies, Inc.) [Auto | Stopped] -- C:\Program Files\Sygate\SPF\Smc.exe -- (SmcService) SRV - [2001-11-29 01:50:00 | 001,769,472 | ---- | M] (Borland Software Corporation) [On_Demand | Stopped] -- C:\Program Files\Borland\InterBase\bin\ibserver.exe -- (InterBaseServer) SRV - [2001-11-29 01:50:00 | 000,032,768 | ---- | M] (Borland Software Corporation) [Auto | Stopped] -- C:\Program Files\Borland\InterBase\bin\ibguard.exe -- (InterBaseGuardian) SRV - [1997-04-09 22:04:50 | 000,050,176 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\System32\CrypServ.exe -- (Crypkey License) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2010-04-14 23:59:35 | 000,075,264 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Documents and Settings\Kermit\Ustawienia lokalne\Temp\briojajchvevs.sys -- (lawxrtky) DRV - [2009-04-09 16:21:12 | 000,055,768 | ---- | M] (ESET) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\epfwtdi.sys -- (epfwtdi) DRV - [2009-04-09 16:21:10 | 000,033,096 | ---- | M] (ESET) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\epfwndis.sys -- (Epfwndis) DRV - [2009-04-09 16:21:06 | 000,133,000 | ---- | M] (ESET) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\epfw.sys -- (epfw) DRV - [2009-04-09 16:18:02 | 000,107,256 | ---- | M] (ESET) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\ehdrv.sys -- (ehdrv) DRV - [2009-04-09 16:10:30 | 000,113,960 | ---- | M] (ESET) [File_System | Auto | Stopped] -- C:\WINDOWS\system32\drivers\eamon.sys -- (eamon) DRV - [2009-03-27 02:16:28 | 000,012,672 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\cpuz132_x32.sys -- (cpuz132) DRV - [2008-01-16 21:14:07 | 000,020,520 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ggsemc.sys -- (ggsemc) DRV - [2008-01-16 21:14:07 | 000,013,352 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ggflt.sys -- (ggflt) DRV - [2007-12-05 02:41:00 | 007,435,392 | ---- | M] (NVIDIA Corporation) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2007-04-23 16:54:50 | 000,100,488 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s115mgmt.sys -- (s115mgmt) Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM) DRV - [2007-04-23 16:54:50 | 000,098,568 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s115obex.sys -- (s115obex) DRV - [2007-04-23 16:54:48 | 000,108,680 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s115mdm.sys -- (s115mdm) DRV - [2007-04-23 16:54:48 | 000,015,112 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s115mdfl.sys -- (s115mdfl) DRV - [2007-04-23 16:54:46 | 000,083,208 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s115bus.sys -- (s115bus) Sony Ericsson Device 115 driver (WDM) DRV - [2007-04-03 14:57:42 | 000,083,336 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s116bus.sys -- (s116bus) Sony Ericsson Device 116 driver (WDM) DRV - [2006-09-13 20:19:02 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum) DRV - [2006-07-11 15:38:30 | 000,020,480 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus) DRV - [2006-07-11 15:38:28 | 000,057,856 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD) DRV - [2006-06-28 11:38:56 | 000,105,088 | R--- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\nvata.sys -- (nvata) DRV - [2006-06-19 00:51:32 | 000,043,520 | ---- | M] (Advanced Micro Devices) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8) DRV - [2006-06-06 06:09:26 | 004,284,928 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2005-02-11 10:24:24 | 000,079,488 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750obex.sys -- (k750obex) DRV - [2005-02-11 10:22:48 | 000,081,728 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750mgmt.sys -- (k750mgmt) DRV - [2005-02-11 10:21:10 | 000,089,872 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750mdm.sys -- (k750mdm) DRV - [2005-02-11 10:21:02 | 000,006,576 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750mdfl.sys -- (k750mdfl) DRV - [2005-02-11 10:19:20 | 000,055,216 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750bus.sys -- (k750bus) Sony Ericsson 750 driver (WDM) DRV - [2005-01-07 18:07:18 | 000,138,752 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Hdaudbus.sys -- (HDAudBus) DRV - [2004-08-10 18:05:44 | 000,014,240 | ---- | M] (Sygate Technologies, Inc.) [Kernel | Auto | Stopped] -- C:\WINDOWS\SYSTEM32\Drivers\wg6n.sys -- (wg6n) DRV - [2004-08-10 18:05:42 | 000,014,240 | ---- | M] (Sygate Technologies, Inc.) [Kernel | Auto | Stopped] -- C:\WINDOWS\SYSTEM32\Drivers\wg5n.sys -- (wg5n) DRV - [2004-08-10 18:05:42 | 000,014,240 | ---- | M] (Sygate Technologies, Inc.) [Kernel | Auto | Stopped] -- C:\WINDOWS\SYSTEM32\Drivers\wg4n.sys -- (wg4n) DRV - [2004-08-10 18:05:42 | 000,014,240 | ---- | M] (Sygate Technologies, Inc.) [Kernel | Auto | Stopped] -- C:\WINDOWS\SYSTEM32\Drivers\wg3n.sys -- (wg3n) DRV - [2004-08-10 17:53:14 | 000,021,075 | ---- | M] (Sygate Technologies, Inc.) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\wpsdrvnt.sys -- (wpsdrvnt) DRV - [2004-08-10 17:51:30 | 000,059,984 | ---- | M] (Sygate Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\SYSTEM32\Drivers\Teefer.sys -- (Teefer) DRV - [2004-08-03 23:59:44 | 000,095,360 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\atapi.sys -- (atapi) DRV - [2004-04-30 10:37:02 | 000,160,640 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\a347bus.sys -- (a347bus) DRV - [2004-04-30 10:33:00 | 000,005,248 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\a347scsi.sys -- (a347scsi) DRV - [2001-09-05 08:55:36 | 000,014,940 | R--- | M] (Ericsson Mobile Communications AB) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Epiusb.sys -- (Epiusb) DRV - [1997-04-09 21:31:22 | 000,020,768 | ---- | M] () [Kernel | System | Stopped] -- C:\WINDOWS\system32\ckldrv.sys -- (NetworkX) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3 FF - prefs.js..extensions.enabledItems: {B9C8BE50-7105-4ec6-8FB4-4935C0671648}:0.5.995 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..network.proxy.type: 4 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010-04-07 20:48:47 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010-04-07 20:48:47 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2009-11-16 22:04:13 | 000,000,000 | ---D | M] [2008-07-07 19:43:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kermit\Dane aplikacji\Mozilla\Extensions [2010-04-14 09:09:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kermit\Dane aplikacji\Mozilla\Firefox\Profiles\hng3eva7.default\extensions [2010-02-19 03:55:28 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Kermit\Dane aplikacji\Mozilla\Firefox\Profiles\hng3eva7.default\extensions\{B9C8BE50-7105-4ec6-8FB4-4935C0671648} [2010-01-08 00:01:07 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\Kermit\Dane aplikacji\Mozilla\Firefox\Profiles\hng3eva7.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2010-04-14 09:09:21 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2007-12-11 10:07:00 | 000,307,200 | ---- | M] (ESKA) -- C:\Program Files\Mozilla Firefox\plugins\npOggX.dll [2010-03-21 23:11:05 | 000,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2010-03-21 23:11:05 | 000,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2010-03-21 23:11:05 | 000,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2010-03-21 23:11:05 | 000,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2010-03-21 23:11:05 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2010-03-21 23:11:05 | 000,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: ([2001-10-26 18:45:16 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Solid Converter PDF) - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll (VoyagerSoft, LLC) O3 - HKLM\..\Toolbar: (Solid Converter PDF) - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll (VoyagerSoft, LLC) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - No CLSID value found. O4 - HKLM..\Run: [Alcmtr] c:\windows\Alcmtr.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET Smart Security\egui.exe (ESET) O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe () O4 - HKLM..\Run: [SkyTel] c:\windows\SkyTel.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SmcService] C:\Program Files\Sygate\SPF\Smc.exe (Sygate Technologies, Inc.) O4 - HKCU..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe File not found O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Przyspieszenie uruchomienia programu AutoCAD.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe (Autodesk, Inc) O4 - Startup: C:\Documents and Settings\Kermit\Menu Start\Programy\Autostart\Skrót do Rainlendar.lnk = C:\Program Files\Rainlendar\Rainlendar.exe () O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.) O16 - DPF: {41564D57-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 62.21.99.95 O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Program Files\Orcad\Capture\itss.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Program Files\Orcad\Capture\itss.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (Explorer.exe) - c:\windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: TaskMan - (C:\Documents and Settings\Kermit\Dane aplikacji\jlwcbb.exe) - C:\Documents and Settings\Kermit\Dane aplikacji\jlwcbb.exe (bpbekvmm) O20 - HKCU Winlogon: Shell - (explorer.exe) - c:\windows\explorer.exe (Microsoft Corporation) O20 - HKCU Winlogon: Shell - (C:\Documents and Settings\Kermit\Dane aplikacji\jlwcbb.exe) - C:\Documents and Settings\Kermit\Dane aplikacji\jlwcbb.exe (bpbekvmm) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\Kermit\Dane aplikacji\IrfanView\IrfanView_Wallpaper.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\Kermit\Dane aplikacji\IrfanView\IrfanView_Wallpaper.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008-01-08 00:46:18 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2001-10-26 17:45:06 | 000,000,902 | R--- | M] () - C:\AUTOEXEC.NT -- [ NTFS ] O32 - AutoRun File - [2001-10-26 20:12:38 | 000,000,112 | R--- | M] () - F:\autorun.inf -- [ CDFS ] O32 - AutoRun File - [2003-09-22 07:56:14 | 000,000,027 | R--- | M] () - G:\autorun.inf -- [ CDFS ] O32 - AutoRun File - [2004-08-18 20:41:17 | 000,000,145 | R--- | M] () - H:\autorun.inf -- [ CDFS ] O33 - MountPoints2\F\Shell - "" = AutoRun O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\setup.exe -- [2004-08-04 02:44:18 | 002,584,576 | R--- | M] (Microsoft Corporation) O33 - MountPoints2\G\Shell - "" = AutoRun O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\start.exe -- [2003-10-23 00:40:12 | 006,245,944 | R--- | M] (Macromedia, Inc.) O33 - MountPoints2\H\Shell - "" = AutoRun O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\Setup\rsrc\AUTORUN.EXE -- [2004-08-03 22:29:57 | 000,057,344 | R--- | M] () O33 - MountPoints2\H\Shell\dinstall\command - "" = H:\DirectX\dxsetup.exe -- [2004-07-09 13:08:36 | 000,472,576 | R--- | M] (Microsoft Corporation) O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010-04-15 00:05:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kermit\Pulpit\Nowy folder (2) [2010-04-14 23:46:06 | 000,000,000 | ---D | C] -- C:\_OTL [2010-04-14 23:45:03 | 000,561,664 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Kermit\Pulpit\OTL.exe [2010-04-14 23:02:04 | 000,000,000 | -HSD | C] -- C:\WINDOWS\CSC [2010-04-14 21:48:42 | 000,118,784 | RHS- | C] (bpbekvmm) -- C:\Documents and Settings\Kermit\Dane aplikacji\jlwcbb.exe [2010-04-13 13:47:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kermit\Pulpit\PRZ program zlobek [2010-04-11 22:31:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kermit\Pulpit\Nowy folder (3) [2010-03-30 18:34:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kermit\.ispagpro [2010-03-22 11:32:42 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight [2009-11-16 22:04:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\ESET [2009-03-23 16:51:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Google [2008-11-05 21:51:48 | 000,018,944 | ---- | C] ( ) -- C:\WINDOWS\System32\implode.dll [2008-04-29 15:25:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Apple [2008-01-30 18:27:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Adobe [2008-01-30 02:58:00 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji\Microsoft [2008-01-16 14:50:04 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Microsoft [2008-01-08 19:36:34 | 000,160,640 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\a347bus.sys [2008-01-08 19:36:34 | 000,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\a347scsi.sys [2008-01-08 00:56:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft [2008-01-08 00:54:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010-04-15 00:04:27 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010-04-15 00:00:40 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010-04-14 23:59:44 | 012,058,624 | ---- | M] () -- C:\Documents and Settings\Kermit\ntuser.dat [2010-04-14 23:38:13 | 000,000,188 | -HS- | M] () -- C:\Documents and Settings\Kermit\ntuser.ini [2010-04-14 22:57:48 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kermit\Pulpit\OTL.exe [2010-04-14 21:50:30 | 000,147,488 | ---- | M] () -- C:\WINDOWS\System32\drivers\str.sys [2010-04-14 21:48:40 | 000,237,568 | RHS- | M] () -- C:\Documents and Settings\Kermit\csrss.exe [2010-04-14 21:48:39 | 000,118,784 | RHS- | M] (bpbekvmm) -- C:\Documents and Settings\Kermit\Dane aplikacji\jlwcbb.exe [2010-04-14 00:48:05 | 003,414,528 | ---- | M] (Karol Winnicki) -- C:\Documents and Settings\Kermit\Pulpit\BESTplayer.exe [2010-04-13 09:59:14 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010-04-13 01:23:48 | 000,008,766 | ---- | M] () -- C:\WINDOWS\hh.dat [2010-03-30 21:00:27 | 000,013,824 | ---- | M] () -- C:\Documents and Settings\Kermit\Moje dokumenty\inwestycje.xls [2010-03-28 17:50:30 | 000,448,004 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat [2010-03-28 17:50:30 | 000,392,296 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010-03-28 17:50:30 | 000,074,230 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat [2010-03-28 17:50:30 | 000,058,596 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010-03-28 17:50:29 | 000,984,778 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010-03-25 18:24:29 | 000,026,112 | ---- | M] () -- C:\Documents and Settings\Kermit\Moje dokumenty\Aparaty inne zlecenia.doc [2010-03-23 21:12:17 | 000,022,528 | ---- | M] () -- C:\Documents and Settings\Kermit\Moje dokumenty\wilda9-18.03.2010.xls [2010-03-21 01:55:34 | 000,266,240 | ---- | M] () -- C:\Documents and Settings\Kermit\Moje dokumenty\plan oszczedzania.xls [2010-03-20 13:02:52 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2010-03-19 22:58:04 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2010-03-16 14:32:27 | 000,000,167 | ---- | M] () -- C:\WINDOWS\ConverterCore.INI [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-04-15 00:06:58 | 000,029,722 | R--- | C] () -- C:\WINDOWS\System32\COMMAND.CO [2010-04-14 23:27:21 | 000,001,300 | R--- | C] () -- C:\CONFIG.NT [2010-04-14 23:26:48 | 000,029,722 | R--- | C] () -- C:\COMMAND.CO [2010-04-14 23:26:16 | 000,000,902 | R--- | C] () -- C:\AUTOEXEC.NT [2010-04-14 21:50:13 | 000,147,488 | ---- | C] () -- C:\WINDOWS\System32\drivers\str.sys [2010-04-14 21:48:44 | 000,237,568 | RHS- | C] () -- C:\Documents and Settings\Kermit\csrss.exe [2010-03-23 21:12:16 | 000,022,528 | ---- | C] () -- C:\Documents and Settings\Kermit\Moje dokumenty\wilda9-18.03.2010.xls [2010-03-21 00:38:54 | 000,013,824 | ---- | C] () -- C:\Documents and Settings\Kermit\Moje dokumenty\inwestycje.xls [2010-01-18 22:38:41 | 000,001,128 | ---- | C] () -- C:\Documents and Settings\Kermit\AdobeCS3Clean.log [2010-01-14 22:19:30 | 012,058,624 | ---- | C] () -- C:\Documents and Settings\Kermit\ntuser.dat [2009-06-16 14:02:50 | 000,000,167 | ---- | C] () -- C:\WINDOWS\ConverterCore.INI [2009-06-16 13:09:48 | 000,000,158 | ---- | C] () -- C:\WINDOWS\matlab.ini [2009-06-15 23:22:01 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\FTCJTAG.dll [2009-06-15 23:22:01 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\drivers\FTCJTAG.dll [2009-01-29 00:37:30 | 000,036,352 | ---- | C] () -- C:\WINDOWS\System32\SX32W.DLL [2009-01-29 00:37:30 | 000,005,881 | ---- | C] () -- C:\WINDOWS\RIDE.ini [2009-01-15 23:15:19 | 000,001,033 | ---- | C] () -- C:\Documents and Settings\Kermit\Dane aplikacji\ShiftN.ini [2008-11-21 01:58:19 | 000,000,799 | ---- | C] () -- C:\WINDOWS\CoDUO.INI [2008-11-06 00:37:29 | 000,000,725 | ---- | C] () -- C:\WINDOWS\CoD.INI [2008-11-05 21:51:49 | 000,251,904 | ---- | C] () -- C:\WINDOWS\System32\orant71.dll [2008-11-05 21:51:48 | 000,903,168 | ---- | C] () -- C:\WINDOWS\System32\mitmdl30.dll [2008-11-05 21:51:48 | 000,176,128 | ---- | C] () -- C:\WINDOWS\System32\lffax60n.dll [2008-11-05 21:51:48 | 000,141,824 | ---- | C] () -- C:\WINDOWS\System32\lfcmp60n.dll [2008-11-05 21:51:48 | 000,110,080 | ---- | C] () -- C:\WINDOWS\System32\lfpng60n.dll [2008-11-05 21:51:48 | 000,046,080 | ---- | C] () -- C:\WINDOWS\System32\lftif60n.dll [2008-11-05 21:51:48 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\lfpcx60n.dll [2008-11-05 21:51:48 | 000,022,528 | ---- | C] () -- C:\WINDOWS\System32\lfpct60n.dll [2008-11-05 21:51:48 | 000,022,528 | ---- | C] () -- C:\WINDOWS\System32\lfeps60n.dll [2008-11-05 21:51:48 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\lfbmp60n.dll [2008-11-05 21:51:48 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\lfpsd60n.dll [2008-11-05 21:51:48 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\lftga60n.dll [2008-11-05 21:51:48 | 000,019,456 | ---- | C] () -- C:\WINDOWS\System32\lfwpg60n.dll [2008-11-05 21:51:48 | 000,019,456 | ---- | C] () -- C:\WINDOWS\System32\lfwmf60n.dll [2008-11-05 21:51:48 | 000,018,432 | ---- | C] () -- C:\WINDOWS\System32\lfmsp60n.dll [2008-11-05 21:51:48 | 000,017,920 | ---- | C] () -- C:\WINDOWS\System32\lfmac60n.dll [2008-06-20 21:38:31 | 000,001,632 | ---- | C] () -- C:\WINDOWS\TextEdit99SE.INI [2008-06-10 01:28:14 | 000,000,297 | ---- | C] () -- C:\WINDOWS\SchDwgUtility99SE.ini [2008-06-10 01:11:41 | 000,001,550 | ---- | C] () -- C:\WINDOWS\Netlist99SE.INI [2008-06-09 20:48:08 | 000,000,758 | ---- | C] () -- C:\WINDOWS\ProHelp99SE.INI [2008-06-09 20:44:59 | 000,083,683 | R--- | C] () -- C:\WINDOWS\CRP9516A.DLL [2008-06-09 20:44:59 | 000,023,552 | R--- | C] () -- C:\WINDOWS\CRYP95A.DLL [2008-06-09 20:43:50 | 000,020,768 | ---- | C] () -- C:\WINDOWS\System32\CKLDRV.sys [2008-06-09 20:43:43 | 000,006,815 | ---- | C] () -- C:\WINDOWS\Client99SE.INI [2008-06-09 20:43:43 | 000,003,935 | ---- | C] () -- C:\WINDOWS\AdvSch99SE.ini [2008-06-09 20:43:43 | 000,000,369 | ---- | C] () -- C:\WINDOWS\HelpAdvisor99SE.ini [2008-06-09 20:43:43 | 000,000,332 | ---- | C] () -- C:\WINDOWS\CRYPKEY.INI [2008-06-09 20:43:43 | 000,000,073 | ---- | C] () -- C:\WINDOWS\AdvSIM99SE.INI [2008-06-09 20:11:01 | 000,002,581 | ---- | C] () -- C:\WINDOWS\SE.INI [2008-04-08 13:45:50 | 000,000,000 | ---- | C] () -- C:\WINDOWS\FILTER.INI [2008-01-15 15:05:36 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.INI [2008-01-14 14:40:24 | 000,164,352 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2008-01-14 14:40:23 | 001,559,040 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2008-01-14 14:40:23 | 000,282,624 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2008-01-14 14:40:22 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2008-01-14 14:40:22 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2008-01-14 14:40:22 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2008-01-14 13:20:29 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2008-01-08 17:31:33 | 000,000,672 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2008-01-08 02:39:38 | 000,069,632 | ---- | C] () -- C:\Documents and Settings\Kermit\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008-01-08 01:55:24 | 000,000,132 | ---- | C] () -- C:\WINDOWS\winamp.ini [2008-01-08 01:17:31 | 000,135,168 | R--- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll [2008-01-08 01:05:03 | 000,004,253 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2008-01-08 01:04:59 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2008-01-08 01:00:29 | 000,000,188 | -HS- | C] () -- C:\Documents and Settings\Kermit\ntuser.ini [2008-01-08 01:00:27 | 000,626,688 | -H-- | C] () -- C:\Documents and Settings\Kermit\NTUSER.DAT.LOG [2007-12-05 02:41:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2007-12-05 02:41:00 | 001,474,560 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2007-12-05 02:41:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2007-12-05 02:41:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2007-12-05 02:41:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2004-08-10 21:39:04 | 000,218,264 | ---- | C] () -- C:\WINDOWS\System32\SetAid.dll [2004-08-03 23:59:44 | 000,095,360 | ---- | C] () -- C:\WINDOWS\System32\drivers\atapi.sys [2001-10-28 18:42:30 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll < End of report >

Dodano 14.04.2010 23:40:34:
po włączeniu systemu normalnie pojawił się tym razem taki błąd "system ntvdm napotkał błąd systemu" i dalej nie szło przeczytać bo nastąpił reset, dalej wszystko wisi

**Posty:** 18165 · przez **wojtas** 15 Kwi 2010, 09:16

tu chyba jest jakaś poważniejsza infekcja
Daj loga z combofixa

**Posty:** 26 · przez **dryn3k** 15 Kwi 2010, 13:10

całość robiona jest w trybie awaryjnym, nie wiem czy to ma znaczenie

log z combofixa

Kod: Zaznacz wszystko: ComboFix 10-04-14.01 - Administrator 2010-04-15 9:34.1.1 - x86 MINIMAL Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.767.539 [GMT 2:00] Uruchomiony z: c:\documents and settings\Administrator\Pulpit\ComboFix.exe UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\docume~1\Kermit\USTAWI~1\Temp\knhxtzgb.sys c:\documents and settings\Kermit\csrss.exe c:\recycler\S-1-5-21-0245756254-4736838875-821450128-7853 c:\recycler\S-1-5-21-1123561945-492894223-725345543-1003 c:\recycler\S-1-5-21-1275210071-1214440339-839522115-1003 c:\windows\system32\drivers\str.sys . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_JYYCUBFU -------\Service_jyycubfu ((((((((((((((((((((((((( Pliki utworzone od 2010-03-15 do 2010-04-15 ))))))))))))))))))))))))))))))) . 2010-04-14 20:07 . 2010-04-15 07:23 -------- d-----w- c:\documents and settings\Administrator\Pulpit 2010-04-14 20:07 . 2010-04-14 20:07 -------- d-----w- c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft 2010-04-14 20:07 . 2010-04-14 20:07 -------- d-----w- c:\documents and settings\Administrator 2010-04-14 20:07 . 2008-01-07 23:37 -------- d-----w- c:\documents and settings\Administrator\Ulubione 2010-04-14 20:07 . 2008-01-07 23:37 -------- d-----w- c:\documents and settings\Administrator\Moje dokumenty 2010-04-14 20:07 . 2008-01-07 23:37 -------- d-----r- c:\documents and settings\Administrator\Menu Start 2010-04-14 20:07 . 2008-01-07 22:42 -------- d--h--w- c:\documents and settings\Administrator\Szablony 2010-03-30 16:34 . 2010-03-30 16:34 -------- d-----w- c:\documents and settings\Kermit\.ispagpro 2010-03-22 09:32 . 2010-03-22 09:32 -------- d-----w- c:\program files\Microsoft Silverlight . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-04-15 07:27 . 2008-12-08 16:03 8810 ----a-w- c:\windows\hh.dat 2010-04-14 19:48 . 2010-04-15 07:22 118784 --sh--r- c:\documents and settings\Administrator\Dane aplikacji\jlwcbb.exe 2010-04-14 19:48 . 2010-04-15 07:22 118784 --sh--r- c:\documents and settings\Administrator\Dane aplikacji\jlwcbb.exe 2010-04-14 19:48 . 2010-04-14 19:48 118784 --sh--r- c:\documents and settings\Kermit\Dane aplikacji\jlwcbb.exe 2010-04-14 19:48 . 2010-04-14 19:48 118784 --sh--r- c:\documents and settings\Kermit\Dane aplikacji\jlwcbb.exe 2010-04-13 22:47 . 2008-10-08 01:31 -------- d-----w- c:\documents and settings\Kermit\Dane aplikacji\BESTplayer 2010-04-13 00:55 . 2009-06-16 11:00 -------- d-----w- c:\documents and settings\Kermit\Dane aplikacji\SolidDocuments 2010-03-28 15:50 . 2001-10-26 17:15 74230 ----a-w- c:\windows\system32\perfc015.dat 2010-03-28 15:50 . 2001-10-26 17:15 448004 ----a-w- c:\windows\system32\perfh015.dat 2010-03-12 19:14 . 2008-05-19 15:22 -------- d-----w- c:\documents and settings\Kermit\Dane aplikacji\uTorrent 2010-02-16 23:24 . 2008-04-21 21:51 -------- d-----w- c:\program files\English Translator 3 . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_3"="advpack.dll" [2007-12-07 124928] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2006-06-01 16208384] "SkyTel"="SkyTel.EXE" [2006-05-16 2879488] "SmcService"="c:\progra~1\Sygate\SPF\smc.exe" [2004-08-13 2532576] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-16 149280] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776] "nwiz"="nwiz.exe" [2007-12-05 1626112] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_3"="advpack.dll" [2007-12-07 124928] c:\documents and settings\Kermit\Menu Start\Programy\Autostart\ Skr˘t do Rainlendar.lnk - c:\program files\Rainlendar\Rainlendar.exe [2007-5-15 40960] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-1-15 113664] Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696] Przyspieszenie uruchomienia programu AutoCAD.lnk - c:\program files\Common Files\Autodesk Shared\acstart17.exe [2006-3-5 11000] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\eMule\\emule.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Java\\jre1.6.0_03\\launch4j-tmp\\JDownloader.exe"= "c:\\WINDOWS\\system32\\java.exe"= "d:\\gry\\quake3\\quake3.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "2486:TCP"= 2486:TCP:adtua S2 ckrfncmcd;Center Task;c:\windows\system32\svchost.exe -k netsvcs [2004-08-04 14336] S2 febnbvkfrkekrp;\??\c:\docume~;\??\c:\docume~1\ADMINI~1\USTAWI~1\Temp\hqbeghicslhznpx.sys --> c:\docume~1\ADMINI~1\USTAWI~1\Temp\hqbeghicslhznpx.sys [?] S2 lawxrtky;\??\c:\d;\??\c:\docume~1\Kermit\USTAWI~1\Temp\briojajchvevs.sys --> c:\docume~1\Kermit\USTAWI~1\Temp\briojajchvevs.sys [?] S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2008-01-16 13352] S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\drivers\s115bus.sys [2008-01-10 83208] S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\drivers\s115mdfl.sys [2008-01-10 15112] S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\drivers\s115mdm.sys [2008-01-10 108680] S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s115mgmt.sys [2008-01-10 100488] S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\system32\drivers\s115obex.sys [2008-01-10 98568] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs ckrfncmcd . Zawartość folderu 'Zaplanowane zadania' 2010-03-19 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] . . ------- Skan uzupełniający ------- . IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 FF - ProfilePath - ---- FIREFOX - SPOSÓB POSTĘPOWANIA ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-04-15 09:41 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\vsdatant] "ImagePath"="" . Czas ukończenia: 2010-04-15 09:45:33 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2010-04-15 07:45 Przed: 5 425 451 008 bajtów wolnych Po: 5 317 574 656 bajtów wolnych - - End Of File - - CA6E514B9402B7DFF2993E63340A3BB1

log z gmer

Kod: Zaznacz wszystko: GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-04-15 13:11:44 Windows 5.1.2600 Dodatek Service Pack 2 Running: e0rjpvpk.exe; Driver: C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\kxpirfod.sys ---- Kernel code sections - GMER 1.0.15 ---- ? Combo-Fix.sys Nie można odnaleźć określonego pliku. ! ? C:\ComboFix\catchme.sys System nie może odnaleźć określonej ścieżki. ! ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\ControlSet001\Services\ckrfncmcd@DisplayName Center Task Reg HKLM\SYSTEM\ControlSet001\Services\ckrfncmcd@Type 32 Reg HKLM\SYSTEM\ControlSet001\Services\ckrfncmcd@Start 2 Reg HKLM\SYSTEM\ControlSet001\Services\ckrfncmcd@ErrorControl 0 Reg HKLM\SYSTEM\ControlSet001\Services\ckrfncmcd@ImagePath %SystemRoot%\system32\svchost.exe -k netsvcs Reg HKLM\SYSTEM\ControlSet001\Services\ckrfncmcd@ObjectName LocalSystem Reg HKLM\SYSTEM\ControlSet001\Services\ckrfncmcd@Description Zapewnia trzy us?ugi zarz?dzania: Us?ug? bazy danych wykazu, kt?ra potwierdza podpisy plik?w systemu Windows, Us?ug? chronionego magazynu g??wnego, kt?ra dodaje i usuwa certyfikaty zaufanego g??wnego urz?du certyfikacji z tego komputera i Us?ug? kluczy, kt?ra pomaga zarejestrowa? ten komputer dla certyfikat?w. Je?li ta us?uga zostanie zatrzymana, te us?ugi zarz?dzania nie b?d? dzia?a? w?a?ciwie. Je?li ta us?uga zostanie wy??czona, wszelkie us?ugi jawnie od niej zale?ne przestan? si? uruchamia?. Reg HKLM\SYSTEM\ControlSet001\Services\ckrfncmcd\Parameters (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\ckrfncmcd\Parameters@ServiceDll C:\WINDOWS\system32\eveaka.dll ---- EOF - GMER 1.0.15 ----

**Posty:** 18165 · przez **wojtas** 15 Kwi 2010, 13:56

Otworz notatnik i wklej w nim to:

File::
c:\windows\hh.dat
C:\documents and settings\Administrator\Dane aplikacji\jlwcbb.exe
c:\documents and settings\Administrator\Dane aplikacji\jlwcbb.exe
c:\documents and settings\Kermit\Dane aplikacji\jlwcbb.exe
c:\documents and settings\Kermit\Dane aplikacji\jlwcbb.exe
C:\WINDOWS\system32\eveaka.dll

Registry::
[HKEY_LOCAL_MACHINE\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2486:TCP"=-

Driver::
febnbvkfrkekrp
lawxrtky

NetSvc::
ckrfncmcd

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Rozpocznie się usuwanie i powstanie log daj go + nowy Gmer

**Posty:** 26 · przez **dryn3k** 15 Kwi 2010, 14:03

Czy jest sens robienie kolejnego gmera z trybu awaryjnego ? To wklejony wyżej Gmer robił sie ponad 3 h.

**Posty:** 18165 · przez **wojtas** 15 Kwi 2010, 14:05

tym razem powinno pójść szybciej gdy wykonasz z Combofixem

, a nawet z normalnym może pójdzie.. postaraj się dać wszystko o co prosiłem

**Posty:** 26 · przez **dryn3k** 15 Kwi 2010, 14:16

mam jeszcze takie pytanie, otóż linijka :

Driver::
febnbvkfrkekrp
lawxrtky

usuwa vira z pena?? bo chodzi o to że działamy na jednym pendrivie między tym kompem z którego piszę a tym kompem co jest zarażony i czy możliwe że on jakoś przechodzi i robimy cały czas kółko, pen oczywiście nie ten który to wszystko spowodował :wink:

Dodano 15.04.2010 15:56:29:
okeej, więc jest

combofix

Kod: Zaznacz wszystko: ComboFix 10-04-14.01 - Administrator 2010-04-15 14:05:18.2.1 - x86 MINIMAL Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.767.482 [GMT 2:00] Uruchomiony z: c:\documents and settings\Administrator\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\Administrator\Pulpit\CFScript.txt UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! FILE :: "c:\documents and settings\Administrator\Dane aplikacji\jlwcbb.exe" "c:\documents and settings\Kermit\Dane aplikacji\jlwcbb.exe" "c:\windows\hh.dat" "c:\windows\system32\eveaka.dll" . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Administrator\Dane aplikacji\jlwcbb.exe c:\documents and settings\Kermit\Dane aplikacji\jlwcbb.exe c:\windows\hh.dat . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_FEBNBVKFRKEKRP -------\Legacy_LAWXRTKY -------\Service_febnbvkfrkekrp -------\Service_lawxrtky ((((((((((((((((((((((((( Pliki utworzone od 2010-03-15 do 2010-04-15 ))))))))))))))))))))))))))))))) . 2010-04-14 21:46 . 2010-04-14 21:46 -------- d-----w- C:\_OTL 2010-03-30 16:34 . 2010-03-30 16:34 -------- d-----w- c:\documents and settings\Kermit\.ispagpro 2010-03-22 09:32 . 2010-03-22 09:32 -------- d-----w- c:\program files\Microsoft Silverlight . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-04-13 22:47 . 2008-10-08 01:31 -------- d-----w- c:\documents and settings\Kermit\Dane aplikacji\BESTplayer 2010-04-13 00:55 . 2009-06-16 11:00 -------- d-----w- c:\documents and settings\Kermit\Dane aplikacji\SolidDocuments 2010-03-28 15:50 . 2001-10-26 17:15 74230 ----a-w- c:\windows\system32\perfc015.dat 2010-03-28 15:50 . 2001-10-26 17:15 448004 ----a-w- c:\windows\system32\perfh015.dat 2010-03-12 19:14 . 2008-05-19 15:22 -------- d-----w- c:\documents and settings\Kermit\Dane aplikacji\uTorrent 2010-02-16 23:24 . 2008-04-21 21:51 -------- d-----w- c:\program files\English Translator 3 . ((((((((((((((((((((((((((((( SnapShot@2010-04-15_07.41.54 ))))))))))))))))))))))))))))))))))))))))) . + 2010-04-15 12:18 . 2010-04-15 12:18 16384 c:\windows\temp\Perflib_Perfdata_e4.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2006-06-01 16208384] "SkyTel"="SkyTel.EXE" [2006-05-16 2879488] "SmcService"="c:\progra~1\Sygate\SPF\smc.exe" [2004-08-13 2532576] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-16 149280] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776] "nwiz"="nwiz.exe" [2007-12-05 1626112] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_3"="advpack.dll" [2007-12-07 124928] c:\documents and settings\Kermit\Menu Start\Programy\Autostart\ Skr˘t do Rainlendar.lnk - c:\program files\Rainlendar\Rainlendar.exe [2007-5-15 40960] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-1-15 113664] Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696] Przyspieszenie uruchomienia programu AutoCAD.lnk - c:\program files\Common Files\Autodesk Shared\acstart17.exe [2006-3-5 11000] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\eMule\\emule.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Java\\jre1.6.0_03\\launch4j-tmp\\JDownloader.exe"= "c:\\WINDOWS\\system32\\java.exe"= "d:\\gry\\quake3\\quake3.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "2486:TCP"= 2486:TCP:adtua S2 ckrfncmcd;Center Task;c:\windows\system32\svchost.exe -k netsvcs [2004-08-04 14336] S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2008-01-16 13352] S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\drivers\s115bus.sys [2008-01-10 83208] S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\drivers\s115mdfl.sys [2008-01-10 15112] S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\drivers\s115mdm.sys [2008-01-10 108680] S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s115mgmt.sys [2008-01-10 100488] S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\system32\drivers\s115obex.sys [2008-01-10 98568] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] \Shell\AutoRun\command - G:\start.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] \Shell\AutoRun\command - h:\setup\rsrc\Autorun.exe \Shell\dinstall\command - h:\directx\dxsetup.exe . Zawartość folderu 'Zaplanowane zadania' 2010-03-19 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.onet.pl/ IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 FF - ProfilePath - c:\documents and settings\Kermit\Dane aplikacji\Mozilla\Firefox\Profiles\hng3eva7.default\ FF - prefs.js: network.proxy.type - 4 FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npOggX.dll FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll ---- FIREFOX - SPOSÓB POSTĘPOWANIA ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . - - - - USUNIĘTO PUSTE WPISY - - - - WebBrowser-{07B18EA9-A523-4961-B6BB-170DE4475CCA} - (no file) ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-04-15 14:19 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\vsdatant] "ImagePath"="" . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'explorer.exe'(180) c:\windows\system32\SSSensor.dll c:\windows\system32\wpdshext.dll c:\windows\system32\PortableDeviceApi.dll c:\windows\system32\Audiodev.dll c:\windows\system32\WMVCore.DLL c:\windows\system32\WMASF.DLL c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\Sygate\SPF\smc.exe c:\windows\system32\crypserv.exe c:\program files\Borland\InterBase\bin\ibguard.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\windows\system32\nvsvc32.exe c:\program files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe c:\program files\Borland\InterBase\bin\ibserver.exe c:\windows\system32\wscntfy.exe c:\windows\RTHDCPL.EXE c:\windows\system32\RUNDLL32.EXE . ************************************************************************** . Czas ukończenia: 2010-04-15 14:23:43 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2010-04-15 12:23 ComboFix2.txt 2010-04-15 07:45 Przed: 5 325 651 968 bajtów wolnych Po: 4 481 298 432 bajtów wolnych - - End Of File - - 791CD738915B388B619ED158BF580908

gmer

Kod: Zaznacz wszystko: GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-04-15 16:50:21 Windows 5.1.2600 Dodatek Service Pack 2 Running: e0rjpvpk.exe; Driver: C:\DOCUME~1\Kermit\USTAWI~1\Temp\kxpirfod.sys ---- System - GMER 1.0.15 ---- SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwAllocateVirtualMemory [0xF7589B30] SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwCreateThread [0xF75896F0] SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwMapViewOfSection [0xF7589470] SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwProtectVirtualMemory [0xF7589C50] SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwShutdownSystem [0xF7589990] SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwTerminateProcess [0xF75898D0] SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwWriteVirtualMemory [0xF7589D60] ---- Kernel code sections - GMER 1.0.15 ---- ? Combo-Fix.sys Nie można odnaleźć określonego pliku. ! .text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF6888380, 0x346307, 0xE8000020] .text wanarp.sys F75BC402 2 Bytes [90, 90] {NOP ; NOP } ? C:\ComboFix\catchme.sys System nie może odnaleźć określonej ścieżki. ! ---- Kernel IAT/EAT - GMER 1.0.15 ---- IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisCloseAdapter] [F71B8AD0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisOpenAdapter] [F71B8A30] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisDeregisterProtocol] [F71B8970] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisRegisterProtocol] [F71B8760] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] [F71B8760] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] [F71B8A30] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] [F71B8AD0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] [F71B8970] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol] [F71B8970] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] [F71B8760] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter] [F71B8A30] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter] [F71B8AD0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] [F71B8760] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] [F71B8AD0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] [F71B8A30] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] [F71B8970] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [F71B8AD0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [F71B8A30] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [F71B8760] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] [F71B8970] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [F71B8760] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [F71B8A30] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [F71B8AD0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] [F71B8760] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] [F71B8970] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter] [F71B8AD0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter] [F71B8A30] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\rspndr.sys[NDIS.SYS!NdisRegisterProtocol] [F71B8760] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\rspndr.sys[NDIS.SYS!NdisOpenAdapter] [F71B8A30] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\rspndr.sys[NDIS.SYS!NdisDeregisterProtocol] [F71B8970] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) IAT \SystemRoot\system32\DRIVERS\rspndr.sys[NDIS.SYS!NdisCloseAdapter] [F71B8AD0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.) ---- Devices - GMER 1.0.15 ---- Device \Driver\Tcpip \Device\Ip wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) Device \Driver\Tcpip \Device\Tcp wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) Device \Driver\Tcpip \Device\Udp wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) Device \Driver\Tcpip \Device\RawIp wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) Device \Driver\Tcpip \Device\IPMULTICAST wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\ControlSet001\Services\ckrfncmcd@DisplayName Center Task Reg HKLM\SYSTEM\ControlSet001\Services\ckrfncmcd@Type 32 Reg HKLM\SYSTEM\ControlSet001\Services\ckrfncmcd@Start 2 Reg HKLM\SYSTEM\ControlSet001\Services\ckrfncmcd@ErrorControl 0 Reg HKLM\SYSTEM\ControlSet001\Services\ckrfncmcd@ImagePath %SystemRoot%\system32\svchost.exe -k netsvcs Reg HKLM\SYSTEM\ControlSet001\Services\ckrfncmcd@ObjectName LocalSystem Reg HKLM\SYSTEM\ControlSet001\Services\ckrfncmcd@Description Zapewnia trzy us?ugi zarz?dzania: Us?ug? bazy danych wykazu, kt?ra potwierdza podpisy plik?w systemu Windows, Us?ug? chronionego magazynu g??wnego, kt?ra dodaje i usuwa certyfikaty zaufanego g??wnego urz?du certyfikacji z tego komputera i Us?ug? kluczy, kt?ra pomaga zarejestrowa? ten komputer dla certyfikat?w. Je?li ta us?uga zostanie zatrzymana, te us?ugi zarz?dzania nie b?d? dzia?a? w?a?ciwie. Je?li ta us?uga zostanie wy??czona, wszelkie us?ugi jawnie od niej zale?ne przestan? si? uruchamia?. Reg HKLM\SYSTEM\ControlSet001\Services\ckrfncmcd\Parameters (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\ckrfncmcd\Parameters@ServiceDll C:\WINDOWS\system32\eveaka.dll ---- Files - GMER 1.0.15 ---- File C:\Documents and Settings\Kermit\Pulpit\ComboFix.txt 0 bytes ---- EOF - GMER 1.0.15 ----

dodam tylko że pojawia się ten komunikat" z tytułu tematu" gdzieś tam raz na jakiś czas przy otwieraniu różnych programów, ale system jako tako działa

Dodano 22.04.2010 19:44:11:
czysto nie czysto ?? komp działa ale już się nikt nie odzywa ?? :?: